@article{wang2005uhd,
  title={{Using honeyclients to detect new attacks [C/OL]}},
  author={WANG, K.},
  year={2005},
  journal={RECON Conference}
}

@article{natvig:2008,
  title={{Emulation: how low will you go...}}, 
  author={Natvig, K}, 
  year={2008},
  journal={{2nd International CARO Workshop: Packers, Decryptors and Obfuscators}}
}

@article{yuan2007csh,
  title={{Client-side honeypots}},
  author={Yuan, B.},
  journal={Master's thesis, University of Mannheim},
  year={2007}
}

@article{ikinci:dmw,
  title={{Detecting Malicious Web Sites}},
  author={Ikinci, A.},
  journal={Diploma thesis, Laboratory for Dependable Distributed Systems},
  year={2007}
}

@article{seifert2006hli,
  title={{HoneyC-The Low-Interaction Client Honeypot}},
  author={Seifert, C. and Welch, I. and Komisarczuk, P.},
  journal={NZCSRCS,(Hamilton, 2007), Available from http://www.mcs.vuw.ac.nz/cseifert/blog/images/seifert-honeyc.pdf; accessed on},
  volume={10},
  year={2006}
}

@article{feinstein:cma,
  title={{Caffeine Monkey: Automated Collection, Detection and Analysis of Malicious JavaScript}},
  journal={{Black Hat USA}},
  year={2007},
  author={Feinstein, B. and Peck, C.D. and SecureWorks, I.}
}

@conference{wang2006awp,
  title={{Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities}},
  author={Wang, Y.M. and Beck, D. and Jiang, X. and Roussev, R. and Verbowski, C. and Chen, S. and King, S.},
  booktitle={Proc. NDSS},
  year={2006}
}

@techreport{provos:ayi,
  title={{All Your iFrames Point To Us}},
  author={Provos, N. and Mavrommatis, P. and Rajab, M.A. and Monrose, F.},
  institution={Technical Report provos-2008a, Google Inc, 2008. http://research.google.com/archive/provos-2008a.pdf},
  year={2008}
}

@misc{rocaspana:sch,
  title={{SHELIA: A Client HoneyPot For Client-Side Attack Detection}},
  author={Rocaspana, J.R.},
  note={\url{http://www.cs.vu.nl/~herbertb/misc/shelia/}},
  year={2009}
}

@article{baecher2006npe,
  title={{The Nepenthes Platform: An Efficient Approach to Collect Malware}},
  author={Baecher, P. and Koetter, M. and Holz, T. and Dornseif, M. and Freiling, F.},
  journal={LECTURE NOTES IN COMPUTER SCIENCE},
  volume={4219},
  pages={165},
  year={2006},
  publisher={Springer}
}

@article{freiling2005bte,
  title={{Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks}},
  author={Freiling, F.C. and Holz, T. and Wicherski, G.},
  journal={LECTURE NOTES IN COMPUTER SCIENCE},
  volume={3679},
  pages={319},
  year={2005},
  publisher={Springer}
}

@misc{vanrossum2001plw,
  title={{Python Language Website}},
  author={van Rossum, G. and others},
  note={\url{http://www.python.org}},
  year={2009}
}

@misc{secunia:nctaudiofile,
  title={{Cool Audio Products NCTAudioFile2 ActiveX Control Buffer Overflow}},
  author={Secunia Research},
  note={\url{http://secunia.com/secunia_research/2007-34/}},
  year={2007}
}

@article{ward2003clw,
  title={{Curl: a language for web content}},
  author={Ward, S. and Hostetter, M.},
  journal={International Journal of Web Engineering and Technology},
  volume={1},
  number={1},
  pages={41--62},
  year={2003},
  publisher={Inderscience}
}

@article{bernerslee:htp,
  title={{Hypertext Transfer Protocol}},
  author={Berners-Lee, T. and Fielding, R. and Frystyk, H.},
  journal={Work in progress of the HTTP working group of the IETF.< URL: ftp://nic. merit. edu/documents/internet-drafts/draft-fielding-http-spec-00. txt}
}

@misc{foundation:sjc,
  title={{SpiderMonkey (JavaScript-C) engine}},
  note={\url{http://www.mozilla.org/js/spidermonkey/}},
  author={Foundation, M.}
}

@conference{hallaraker2005dmj,
  title={{Detecting Malicious JavaScript Code in Mozilla}},
  author={Hallaraker, O. and Vigna, G.},
  booktitle={Engineering of Complex Computer Systems, 2005. ICECCS 2005. Proceedings. 10th IEEE International Conference on},
  pages={85--94},
  year={2005}
}

@misc{kojm:ch,
  title={{ClamAV homepage}},
  note={\url{http://clamav.net/}},
  author={Kojm, T.}
}

@misc{pplayer:ex,
    title={{PPStream (PowerPlayer.dll 2.0.1.3829) Activex Remote Overflow Exploit}},
    note={\url{http://www.milw0rm.com/exploits/4348}},
    author={dummy},
    year={2007}
}

@misc{xinlei,
    title={{Xunlei Thunder DapPlayer ActiveX Control Buffer Overflow}},
    author={Secunia},
    note={\url{http://secunia.com/advisories/26964/}},
    year={2007}
}

@misc{vb2py,
  title = {{vb2py homepage}},
  year={2009},
  note={\url{http://vb2py.sourceforge.net/}},
  author={Paterson, P.},
}

@misc{waledec,
  title={{Another Holiday, Another E-Card Run - Waledec}},
  author={Nazario, J.}, 
  note={\url{http://asert.arbornetworks.com/2008/12/another-holiday-another-e-card-run-waledec/}},
  year={2008}
}

@misc{setslice,
  title={{MS Internet Explorer WebViewFolderIcon setSlice() (Multiple Exploits)}},
  author={H D Moore},
  note={\url{http://www.securiteam.com/exploits/6A0060AH5G.html}},
  year={2006},
}

@misc{libemu,
  title={{libemu - x86 shellcode detection and emulation}},
  author={Baecher, P. and Koetter, M.},
  note={\url{http://www.mwcollect.org/}},
  year={2007}
}

@misc{packer20,
  title={{The Packer 2.0 Threat}},
  author={Jackson, D.},
  note={\url{http://www.secureworks.com/research/threats/thepacker/}},
  year={2008}
}

@inproceedings{provos:gba,
 author = {Provos,, Niels and McNamee,, Dean and Mavrommatis,, Panayiotis
and Wang,, Ke and Modadugu,, Nagendra},
 title = {The ghost in the browser analysis of web-based malware},
 booktitle = {HotBots'07: Proceedings of the first conference on First
Workshop on Hot Topics in Understanding Botnets},
 year = {2007},
 pages = {4--4},
 location = {Cambridge, MA},
 publisher = {USENIX Association},
 address = {Berkeley, CA, USA},
}

@article{servers:kye,
  title={{Know Your Enemy: Malicious Web Servers}},
  author={Servers, M.W.}
}

@misc{mara:chc,
  title={{Capture-Honeypot Client, 2006}},
  author={Mara, F. and Tang, Y. and Steenson, R. and Seifert, C.}
}